使用HLF Operator在AKS上无法注册Peer到Hyperledger Fabric CA

错误信息 #

Error: enroll failed: enroll failed: Failed to read response of request: POST http://org1-ca.domain.com/enroll
{"hosts":null,"certificate_request":"-----BEGIN CERTIFICATE REQUEST-----\nMIHxMIGYAgEAMBExDzANBgNVBAMTBmVucm9sbDBZMBMGByqGSM49AgEGCCqGSM49\nAwEHA0IABBQob4jvqjE/E6OZPuKQdPUNw+SMXCI6FtPI3j0rPqxGu9DrnCgasGG\nzop5KWFZrMFL/JrbKfm2+GPrRPrLyjWgJTAjBgkqhkiG9w0BCQ4xFjAUMBIGA1Ud\nEQQLMAmCB0JVSDAwOTcwCgYIKoZIzj0EAwIDSAAwRQIhALWFAahmDd+lmQdkqSgI\nn7M5m+BeFz8fZBzrDVbcbrVzCAiAsThJfkxEdNwm1AQ45KUqT0hDfnHQCAUK0Fjp5\n6IaPPQ==\n-----END CERTIFICATE REQUEST-----\n","profile":"","crl_override":"","label":"","NotBefore":"0001-01-01T00:00:00Z","NotAfter":"0001-01-01T00:00:00Z","ReturnPrecert":false,"CAName":""}: unexpected EOF

环境说明 #

• AKS集群，搭配应用网关、Nginx Ingress做路由
• 使用ExternalDNS在Azure DNS区域做域名解析

Fabric CA配置（fabric-ca.yaml） #

apiVersion: hlf.kungfusoftware.es/v1alpha1
kind: FabricCA
metadata:
  creationTimestamp: null
  name: org1-ca
  namespace: fabric
spec:
  affinity: null
  ca:
    affiliations: null
    bccsp:
      default: SW
      sw:
        hash: SHA2
        security: "256"
    ca: null
    cfg:
      affiliations:
        allowRemove: true
      identities:
        allowRemove: true
    crl:
      expiry: 24h
    csr:
      ca:
        expiry: 131400h
        pathLength: 0
      cn: ca
      hosts:
      - localhost
      - org1-ca.domain.io
      names:
      - C: US
        L: ""
        O: Hyperledger
        OU: North Carolina
        ST: ""
    intermediate:
      parentServer:
        caName: ""
        url: ""
    name: ca
    registry:
      identities:
      - affiliation: ""
        attrs:
          hf.AffiliationMgr: true
          hf.GenCRL: true
          hf.IntermediateCA: true
          hf.Registrar.Attributes: '*'
          hf.Registrar.DelegateRoles: '*'
          hf.Registrar.Roles: '*'
          hf.Revoker: true
        name: enroll
        pass: enrollpw
        type: client
      max_enrollments: -1
    signing: null
    subject:
      C: ES
      L: Alicante
      O: Kung Fu Software
      OU: Tech
      ST: Alicante
      cn: ca
    tlsCa: null
  clrSizeLimit: 512000
  cors:
    enabled: false
    origins: []
  db:
    datasource: fabric-ca-server.db
    type: sqlite3
  debug: false
  env: null
  hosts:
  - localhost
  - org1-ca
  - org1-ca.fabric
  - org1-ca.domain.io
  image: hyperledger/fabric-ca
  imagePullSecrets: null
  istio:
  metrics:
    provider: prometheus
    statsd:
      address: 127.0.0.1:8125
      network: udp
      prefix: server
      writeInterval: 10s
  resources:
    limits:
      cpu: 300m
      memory: 256Mi
    requests:
      cpu: 10m
      memory: 128Mi
  rootCA:
    subject:
      C: California
      L: ""
      O: Hyperledger
      OU: Fabric
      ST: ""
      cn: ca
  service:
    type: ClusterIP
  serviceMonitor: null
  storage:
    accessMode: ReadWriteOnce
    size: 1Gi
    storageClass: default
  tlsCA:
    affiliations: null
    bccsp:
      default: SW
      sw:
        hash: SHA2
        security: "256"
    ca: null
    cfg:
      affiliations:
        allowRemove: true
      identities:
        allowRemove: true
    crl:
      expiry: 24h
    csr:
      ca:
        expiry: 131400h
        pathLength: 0
      cn: tlsca
      hosts:
      - localhost
      - org1-ca.domain.io
      names:
      - C: US
        L: ""
        O: Hyperledger
        OU: North Carolina
        ST: ""
    intermediate:
      parentServer:
        caName: ""
        url: ""
    name: tlsca
    registry:
      identities:
      - affiliation: ""
        attrs:
          hf.AffiliationMgr: true
          hf.GenCRL: true
          hf.IntermediateCA: true
          hf.Registrar.Attributes: '*'
          hf.Registrar.DelegateRoles: '*'
          hf.Registrar.Roles: '*'
          hf.Revoker: true
        name: enroll
        pass: enrollpw
        type: client
      max_enrollments: -1
    signing: null
    subject:
      C: ES
      L: Alicante
      O: Kung Fu Software
      OU: Tech
      ST: Alicante
      cn: tlsca
    tlsCa: null
  tolerations: null
  version: 1.4.9

注册Peer的命令 #

kubectl hlf ca register --name=org1-ca --user=peer --secret=peerpw --type=peer --enroll-id=enroll --enroll-secret=enrollpw --mspid=Org1MSP --namespace=fabric --ca-url=org1-ca.domain.io

解决步骤 #

1. 修正域名拼写不一致问题 #

错误信息中请求的域名是org1-ca.domain.com，但配置和命令中使用的是org1-ca.domain.io，这是典型的拼写错误，必须确保所有配置、命令和DNS解析的域名完全一致。

2. 验证域名解析与服务连通性 #

• 执行nslookup org1-ca.domain.io，确认域名正确指向应用网关的公网IP
• 集群内部测试：进入任意Fabric Pod，执行curl -v http://org1-ca.fabric:7054/enroll，确认CA服务端点正常响应
• 集群外部测试：执行curl -v http://org1-ca.domain.io/enroll，检查是否能正常访问，是否存在网关/Ingress拦截请求的情况

3. 调整Ingress的请求大小限制 #

Fabric CA的注册请求包含CSR内容，若Nginx Ingress的client_max_body_size过小会截断请求，导致unexpected EOF。修改Ingress配置：

annotations:
  nginx.ingress.kubernetes.io/client-max-body-size: "10m"

更新Ingress后，重启Nginx Ingress控制器确保配置生效。

4. 明确CA URL的协议与端口 #

注册命令中--ca-url需明确指定协议和端口：

• 若使用HTTP（Ingress映射80端口）：--ca-url=http://org1-ca.domain.io:80
• 若使用HTTPS（Ingress映射443端口）：--ca-url=https://org1-ca.domain.io:443，同时若未配置可信证书，可添加--tls-insecure参数临时跳过验证（生产环境禁用）

5. 检查Fabric CA服务状态 #

查看CA Pod日志，确认服务正常启动：

kubectl logs -l app=org1-ca -n fabric

检查日志中是否有端口监听失败、配置错误等异常信息，确保CA服务在7054端口正常运行。

6. 验证Operator与Fabric CA版本兼容性 #

当前使用的Fabric CA版本为1.4.9，需确认HLF Operator版本与该版本兼容，避免因协议不匹配导致通信失败。

内容的提问来源于stack exchange，提问作者Iurii Kogan